mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-29 21:08:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

sudo: Fix CVE-2025-32462

Browse Source 
Upstream-Status: Backport from d530367828

(From OE-Core rev: d01f888a5ec43fdc8e7bd496ae9317c0fa28da9b)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Vijay Anusuri
2025-07-08 18:05:31 +05:30
committed by Steve Sakoman
parent 60f859e4be
commit 55a6c02c35
2 changed files with 43 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
meta/recipes-extended/sudo/files/CVE-2025-32462.patch Normal file
View File

@@ -0,0 +1,42 @@
From d530367828e3713d09489872743eb92d31fb11ff Mon Sep 17 00:00:00 2001
From: "Todd C. Miller" <Todd.Miller@sudo.ws>
Date: Tue, 1 Apr 2025 09:24:51 -0600
Subject: [PATCH] Only allow a remote host to be specified when listing
privileges.
This fixes a bug where a user with sudoers privileges on a different
host could execute a command on the local host, even if the sudoers
file would not otherwise allow this. CVE-2025-32462
Reported by Rich Mirch @ Stratascale Cyber Research Unit (CRU).
Upstream-Status: Backport [https://github.com/sudo-project/sudo/commit/d530367828e3713d09489872743eb92d31fb11ff]
CVE: CVE-2025-32462
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
plugins/sudoers/sudoers.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/plugins/sudoers/sudoers.c b/plugins/sudoers/sudoers.c
index 70a0c1a528..ad2fa2f61c 100644
--- a/plugins/sudoers/sudoers.c
+++ b/plugins/sudoers/sudoers.c
@@ -350,6 +350,18 @@ sudoers_check_common(struct sudoers_context *ctx, int pwflag)
time_t now;
debug_decl(sudoers_check_common, SUDOERS_DEBUG_PLUGIN);
+ /* The user may only specify a host for "sudo -l". */
+ if (!ISSET(ctx->mode, MODE_LIST|MODE_CHECK)) {
+ if (strcmp(ctx->runas.host, ctx->user.host) != 0) {
+ log_warningx(ctx, SLOG_NO_STDERR|SLOG_AUDIT,
+ N_("user not allowed to set remote host for command"));
+ sudo_warnx("%s",
+ U_("a remote host may only be specified when listing privileges."));
+ ret = false;
+ goto done;
+ }
+ }
+
/* If given the -P option, set the "preserve_groups" flag. */
if (ISSET(ctx->mode, MODE_PRESERVE_GROUPS))
def_preserve_groups = true;

1
meta/recipes-extended/sudo/sudo_1.9.15p5.bb
View File

@@ -3,6 +3,7 @@ require sudo.inc
SRC_URI = "https://www.sudo.ws/dist/sudo-${PV}.tar.gz \
${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
file://0001-sudo.conf.in-fix-conflict-with-multilib.patch \
file://CVE-2025-32462.patch \
"
PAM_SRC_URI = "file://sudo.pam"